01 · Definition
What is malicious url lookup?
A malicious URL check queries threat intelligence databases to determine whether a web address has been flagged as a phishing site, malware host, command-and-control server or other unsafe destination. Threat intelligence feeds — maintained by security researchers, anti-abuse organisations and browser vendors — continuously catalogue URLs reported as harmful.
This tool checks any URL against the threat intelligence index and returns an instant safe or flagged verdict. Use it before including a link in an email campaign, when investigating a suspected phishing message, or when vetting third-party URLs. Read the in-depth malicious URL lookup guide for context on how threat intelligence feeds work and what to do when a URL is flagged.
02 · Process
How it works
- 1Enter a URL.Paste any web address — with or without
https://. The tool normalises the URL before checking. - 2Query threat intelligence feeds.The tool submits the URL to the threat intelligence index and retrieves the current verdict from the database.
- 3Read the verdict.A safe result means the URL has not been flagged in the threat intelligence database. A flagged result means at least one feed has reported the URL as harmful.
- 4Act on flagged URLs.Remove flagged URLs from email campaigns immediately. Report phishing URLs to the relevant hosting provider and submit them to browser Safe Browsing APIs.
03 · Risk
Why it matters
Phishing URLs embedded in email campaigns — including in images, buttons or tracked links — can get an entire sending domain flagged by spam filters. A single malicious link in a newsletter can trigger complaints, blacklistings and domain reputation damage that takes weeks to clear.
For email marketers, third-party content and user-generated links are the most common source of accidentally malicious URLs. Checking links before sending is a simple gate that prevents inherited reputation damage from third-party sites that were compromised after you last visited them.
04 · Use cases
Common ways to use this tool
- Pre-send campaign URL audit. Scan every link in an email template before the campaign goes out to confirm none of the destination URLs have been flagged since the content was drafted.
- Phishing email investigation. Check URLs from suspected phishing messages to confirm whether they are live threats before reporting or clicking.
- Shortened URL expansion and check. Expand and check short URLs before sharing — shortened links hide the destination and are a common phishing delivery mechanism.
- Third-party content vetting. Verify URLs from partner content, user submissions or affiliate links before including them in outbound email.
05 · Interpretation
What to check in the result
- Flagged verdict. Remove the URL from your campaign immediately. Do not send until the link is replaced or the flagging is confirmed as a false positive by the feed operator.
- Safe verdict but URL looks suspicious. Threat intelligence feeds are not exhaustive — a URL can be harmful before it has been reported. Verify the destination by checking the domain registration date, WHOIS data and whether the page matches what you expect.
- URL points to a redirect chain. The check evaluates the URL you enter, not every hop in a redirect chain. For shortened or redirect URLs, expand the final destination first and check that URL directly.